From 1461e55a00e1cdacaa47e9cc5cd2c1aa9a64603b Mon Sep 17 00:00:00 2001 From: Ilka Schulz Date: Thu, 16 Jul 2026 10:11:45 +0200 Subject: [PATCH] cargo vet regenerate exemptions --- supply-chain/config.toml | 100 ++++++------ supply-chain/imports.lock | 322 +++++++------------------------------- 2 files changed, 113 insertions(+), 309 deletions(-) diff --git a/supply-chain/config.toml b/supply-chain/config.toml index 5addcfba..343d9a8a 100644 --- a/supply-chain/config.toml +++ b/supply-chain/config.toml @@ -73,10 +73,6 @@ criteria = "safe-to-deploy" version = "3.0.11" criteria = "safe-to-deploy" -[[exemptions.anyhow]] -version = "1.0.103" -criteria = "safe-to-deploy" - [[exemptions.ar_archive_writer]] version = "0.5.2" criteria = "safe-to-deploy" @@ -110,7 +106,7 @@ version = "0.71.1" criteria = "safe-to-deploy" [[exemptions.bitflags]] -version = "2.13.0" +version = "2.13.1" criteria = "safe-to-deploy" [[exemptions.blake2]] @@ -122,17 +118,21 @@ version = "0.1.4" criteria = "safe-to-deploy" [[exemptions.bytes]] -version = "1.12.0" +version = "1.12.1" criteria = "safe-to-deploy" [[exemptions.cc]] -version = "1.2.65" +version = "1.2.67" criteria = "safe-to-deploy" [[exemptions.chacha20]] version = "0.9.1" criteria = "safe-to-deploy" +[[exemptions.chacha20]] +version = "0.10.1" +criteria = "safe-to-deploy" + [[exemptions.chacha20poly1305]] version = "0.10.1" criteria = "safe-to-deploy" @@ -142,15 +142,15 @@ version = "1.8.1" criteria = "safe-to-deploy" [[exemptions.clap]] -version = "4.6.1" +version = "4.6.2" criteria = "safe-to-deploy" [[exemptions.clap_builder]] -version = "4.6.0" +version = "4.6.2" criteria = "safe-to-deploy" [[exemptions.clap_complete]] -version = "4.6.5" +version = "4.6.7" criteria = "safe-to-deploy" [[exemptions.clap_derive]] @@ -185,12 +185,16 @@ criteria = "safe-to-deploy" version = "0.5.1" criteria = "safe-to-run" +[[exemptions.crossbeam-channel]] +version = "0.5.16" +criteria = "safe-to-run" + [[exemptions.crossbeam-deque]] -version = "0.8.6" +version = "0.8.7" criteria = "safe-to-run" [[exemptions.crossbeam-utils]] -version = "0.8.20" +version = "0.8.22" criteria = "safe-to-run" [[exemptions.crypto-common]] @@ -238,11 +242,11 @@ version = "0.20.10" criteria = "safe-to-deploy" [[exemptions.defmt]] -version = "1.1.0" +version = "1.1.1" criteria = "safe-to-deploy" [[exemptions.defmt-macros]] -version = "1.1.0" +version = "1.1.1" criteria = "safe-to-deploy" [[exemptions.defmt-parser]] @@ -353,10 +357,6 @@ criteria = "safe-to-deploy" version = "0.2.6" criteria = "safe-to-deploy" -[[exemptions.getrandom]] -version = "0.2.15" -criteria = "safe-to-deploy" - [[exemptions.getrandom]] version = "0.2.17" criteria = "safe-to-deploy" @@ -382,7 +382,7 @@ version = "0.5.12" criteria = "safe-to-deploy" [[exemptions.hybrid-array]] -version = "0.4.12" +version = "0.4.13" criteria = "safe-to-deploy" [[exemptions.indexmap]] @@ -406,19 +406,19 @@ version = "1.0.18" criteria = "safe-to-deploy" [[exemptions.jiff]] -version = "0.2.29" +version = "0.2.32" criteria = "safe-to-deploy" [[exemptions.jiff-static]] -version = "0.2.29" +version = "0.2.32" criteria = "safe-to-deploy" [[exemptions.jobserver]] -version = "0.1.34" +version = "0.1.35" criteria = "safe-to-deploy" [[exemptions.js-sys]] -version = "0.3.102" +version = "0.3.103" criteria = "safe-to-run" [[exemptions.keccak]] @@ -450,7 +450,7 @@ version = "0.4.33" criteria = "safe-to-deploy" [[exemptions.memchr]] -version = "2.8.2" +version = "2.8.3" criteria = "safe-to-deploy" [[exemptions.memoffset]] @@ -466,7 +466,7 @@ version = "0.2.1" criteria = "safe-to-deploy" [[exemptions.mio]] -version = "1.2.1" +version = "1.2.2" criteria = "safe-to-deploy" [[exemptions.neli]] @@ -590,11 +590,15 @@ version = "1.0.46" criteria = "safe-to-deploy" [[exemptions.r-efi]] -version = "5.2.0" +version = "6.0.0" criteria = "safe-to-deploy" -[[exemptions.r-efi]] -version = "6.0.0" +[[exemptions.rand]] +version = "0.8.7" +criteria = "safe-to-run" + +[[exemptions.rand]] +version = "0.10.2" criteria = "safe-to-deploy" [[exemptions.rand_core]] @@ -610,11 +614,11 @@ version = "0.5.18" criteria = "safe-to-deploy" [[exemptions.regex]] -version = "1.12.4" +version = "1.13.1" criteria = "safe-to-deploy" [[exemptions.regex-automata]] -version = "0.4.9" +version = "0.4.16" criteria = "safe-to-deploy" [[exemptions.regex-syntax]] @@ -630,17 +634,21 @@ version = "0.21.0" criteria = "safe-to-deploy" [[exemptions.rustc-demangle]] -version = "0.1.27" +version = "0.1.28" criteria = "safe-to-run" [[exemptions.rustc-hash]] -version = "2.1.2" +version = "2.1.3" criteria = "safe-to-deploy" [[exemptions.rustix]] version = "1.1.4" criteria = "safe-to-deploy" +[[exemptions.rustversion]] +version = "1.0.23" +criteria = "safe-to-run" + [[exemptions.ryu]] version = "1.0.23" criteria = "safe-to-deploy" @@ -698,7 +706,7 @@ version = "0.4.12" criteria = "safe-to-deploy" [[exemptions.socket2]] -version = "0.6.4" +version = "0.6.5" criteria = "safe-to-deploy" [[exemptions.sponge-cursor]] @@ -714,7 +722,7 @@ version = "1.0.109" criteria = "safe-to-deploy" [[exemptions.syn]] -version = "2.0.118" +version = "2.0.119" criteria = "safe-to-deploy" [[exemptions.take-until]] @@ -746,7 +754,7 @@ version = "2.7.0" criteria = "safe-to-deploy" [[exemptions.toml]] -version = "1.1.2+spec-1.1.0" +version = "1.1.3+spec-1.1.0" criteria = "safe-to-deploy" [[exemptions.toml_datetime]] @@ -758,7 +766,7 @@ version = "1.1.2+spec-1.1.0" criteria = "safe-to-deploy" [[exemptions.toml_writer]] -version = "1.1.1+spec-1.1.0" +version = "1.1.2+spec-1.1.0" criteria = "safe-to-deploy" [[exemptions.typenum]] @@ -778,7 +786,7 @@ version = "0.2.11" criteria = "safe-to-deploy" [[exemptions.uuid]] -version = "1.23.3" +version = "1.24.0" criteria = "safe-to-run" [[exemptions.version_check]] @@ -794,23 +802,23 @@ version = "0.11.0+wasi-snapshot-preview1" criteria = "safe-to-deploy" [[exemptions.wasm-bindgen]] -version = "0.2.125" +version = "0.2.126" criteria = "safe-to-run" [[exemptions.wasm-bindgen-macro]] -version = "0.2.125" +version = "0.2.126" criteria = "safe-to-run" [[exemptions.wasm-bindgen-macro-support]] -version = "0.2.125" +version = "0.2.126" criteria = "safe-to-run" [[exemptions.wasm-bindgen-shared]] -version = "0.2.125" +version = "0.2.126" criteria = "safe-to-run" [[exemptions.web-sys]] -version = "0.3.102" +version = "0.3.103" criteria = "safe-to-run" [[exemptions.winapi-i686-pc-windows-gnu]] @@ -958,7 +966,7 @@ version = "0.52.6" criteria = "safe-to-run" [[exemptions.winnow]] -version = "1.0.3" +version = "1.0.4" criteria = "safe-to-deploy" [[exemptions.wireguard-uapi]] @@ -970,11 +978,11 @@ version = "2.0.1" criteria = "safe-to-deploy" [[exemptions.zerocopy]] -version = "0.8.52" +version = "0.8.54" criteria = "safe-to-deploy" [[exemptions.zerocopy-derive]] -version = "0.8.52" +version = "0.8.54" criteria = "safe-to-deploy" [[exemptions.zeroize]] @@ -986,7 +994,7 @@ version = "1.5.0" criteria = "safe-to-deploy" [[exemptions.zmij]] -version = "1.0.21" +version = "1.0.23" criteria = "safe-to-deploy" [[exemptions.zstd]] diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index 519acfaf..f0a07c14 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -29,18 +29,6 @@ user-id = 696 user-login = "fitzgen" user-name = "Nick Fitzgerald" -[[publisher.wasip2]] -version = "1.0.4+wasi-0.2.12" -when = "2026-06-12" -user-id = 1 -user-login = "alexcrichton" -user-name = "Alex Crichton" - -[[publisher.wit-bindgen]] -version = "0.57.1" -when = "2026-04-17" -trusted-publisher = "github:bytecodealliance/wit-bindgen" - [audits.actix.audits] [[audits.bytecode-alliance.wildcard-audits.arbitrary]] @@ -66,24 +54,6 @@ start = "2020-01-14" end = "2026-08-21" notes = "I am an author of this crate" -[[audits.bytecode-alliance.wildcard-audits.wasip2]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -user-id = 1 # Alex Crichton (alexcrichton) -start = "2025-08-10" -end = "2026-08-21" -notes = """ -This is a Bytecode Alliance authored crate. -""" - -[[audits.bytecode-alliance.wildcard-audits.wit-bindgen]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -trusted-publisher = "github:bytecodealliance/wit-bindgen" -start = "2025-08-13" -end = "2027-01-08" -notes = "The Bytecode Alliance is the author of this crate" - [[audits.bytecode-alliance.audits.addr2line]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -131,6 +101,11 @@ criteria = "safe-to-deploy" version = "0.1.6" notes = "Contains no unsafe code, no IO, no build.rs." +[[audits.bytecode-alliance.audits.anyhow]] +who = "Pat Hickey " +criteria = "safe-to-deploy" +delta = "1.0.69 -> 1.0.71" + [[audits.bytecode-alliance.audits.base64]] who = "Pat Hickey " criteria = "safe-to-deploy" @@ -177,6 +152,12 @@ criteria = "safe-to-deploy" delta = "0.9.15 -> 0.9.18" notes = "Nontrivial update but mostly around dependencies and how `unsafe` code is managed. Everything looks the same shape as before." +[[audits.bytecode-alliance.audits.crossbeam-epoch]] +who = "Alex Crichton " +criteria = "safe-to-deploy" +delta = "0.9.18 -> 0.9.20" +notes = "Minor updates, nothing out of place." + [[audits.bytecode-alliance.audits.embedded-io]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -331,12 +312,6 @@ criteria = "safe-to-deploy" delta = "1.0.8 -> 1.1.3" notes = "Substantial updates, but nothing out of the ordinary one would expect from a serialization crate. Minor `unsafe` updates, but nothing major from what was already there." -[[audits.bytecode-alliance.audits.rand]] -who = "Alex Crichton " -criteria = "safe-to-deploy" -delta = "0.10.0 -> 0.10.1" -notes = "Minor logging-based updated fixing a recent advisory for the crate." - [[audits.bytecode-alliance.audits.shlex]] who = "Alex Crichton " criteria = "safe-to-deploy" @@ -366,6 +341,11 @@ criteria = "safe-to-deploy" delta = "3.5.0 -> 3.6.0" notes = "Dependency updates and new optimized trait implementations, but otherwise everything looks normal." +[[audits.embark-studios.audits.anyhow]] +who = "Johan Andersson " +criteria = "safe-to-deploy" +version = "1.0.58" + [[audits.embark-studios.audits.cfg_aliases]] who = "Johan Andersson " criteria = "safe-to-deploy" @@ -451,18 +431,6 @@ criteria = "safe-to-run" version = "0.2.2" aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" -[[audits.google.audits.crossbeam-channel]] -who = "George Burgess IV " -criteria = "safe-to-run" -version = "0.5.7" -aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" - -[[audits.google.audits.crossbeam-channel]] -who = "George Burgess IV " -criteria = "safe-to-run" -delta = "0.5.7 -> 0.5.8" -aggregated-from = "https://chromium.googlesource.com/chromiumos/third_party/rust_crates/+/refs/heads/main/cargo-vet/audits.toml?format=TEXT" - [[audits.google.audits.crossbeam-epoch]] who = "George Burgess IV " criteria = "safe-to-run" @@ -721,15 +689,6 @@ delta = "1.0.93 -> 1.0.94" notes = "Minor doc changes and clippy lint adjustments+fixes." aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.rand]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "0.8.5" -notes = """ -For more detailed unsafe review notes please see https://crrev.com/c/6362797 -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.rand_chacha]] who = "Lukasz Anforowicz " criteria = "safe-to-deploy" @@ -748,74 +707,6 @@ For more detailed unsafe review notes please see https://crrev.com/c/6362797 """ aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" -[[audits.google.audits.rustversion]] -who = "Lukasz Anforowicz " -criteria = "safe-to-deploy" -version = "1.0.14" -notes = """ -Grepped for `-i cipher`, `-i crypto`, `'\bfs\b'``, `'\bnet\b'``, `'\bunsafe\b'`` -and there were no hits except for: - -* Using trivially-safe `unsafe` in test code: - - ``` - tests/test_const.rs:unsafe fn _unsafe() {} - tests/test_const.rs:const _UNSAFE: () = unsafe { _unsafe() }; - ``` - -* Using `unsafe` in a string: - - ``` - src/constfn.rs: "unsafe" => Qualifiers::Unsafe, - ``` - -* Using `std::fs` in `build/build.rs` to write `${OUT_DIR}/version.expr` - which is later read back via `include!` used in `src/lib.rs`. - -Version `1.0.6` of this crate has been added to Chromium in -https://source.chromium.org/chromium/chromium/src/+/28841c33c77833cc30b286f9ae24c97e7a8f4057 -""" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Adrian Taylor " -criteria = "safe-to-deploy" -delta = "1.0.14 -> 1.0.15" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "danakj " -criteria = "safe-to-deploy" -delta = "1.0.15 -> 1.0.16" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.16 -> 1.0.17" -notes = "Just updates windows compat" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Liza Burakova " -criteria = "safe-to-deploy" -delta = "1.0.17 -> 1.0.18" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Dustin J. Mitchell " -criteria = "safe-to-deploy" -delta = "1.0.18 -> 1.0.19" -notes = "No unsafe, just doc changes" -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - -[[audits.google.audits.rustversion]] -who = "Daniel Cheng " -criteria = "safe-to-deploy" -delta = "1.0.19 -> 1.0.20" -notes = "Only minor updates to documentation and the mock today used for testing." -aggregated-from = "https://chromium.googlesource.com/chromium/src/+/main/third_party/rust/chromium_crates_io/supply-chain/audits.toml?format=TEXT" - [[audits.google.audits.same-file]] who = "Android Legacy" criteria = "safe-to-run" @@ -1173,11 +1064,6 @@ who = "David Cook " criteria = "safe-to-deploy" delta = "1.0.3 -> 1.0.4" -[[audits.isrg.audits.chacha20]] -who = "David Cook " -criteria = "safe-to-deploy" -version = "0.10.0" - [[audits.isrg.audits.cpufeatures]] who = "David Cook " criteria = "safe-to-deploy" @@ -1299,11 +1185,6 @@ criteria = "safe-to-deploy" delta = "0.2.8 -> 0.2.9" notes = "No changes to Rust code between 0.2.8 and 0.2.9" -[[audits.isrg.audits.getrandom]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "0.3.3 -> 0.3.4" - [[audits.isrg.audits.once_cell]] who = "J.C. Jones " criteria = "safe-to-deploy" @@ -1326,21 +1207,6 @@ who = "David Cook " criteria = "safe-to-run" version = "0.6.0" -[[audits.isrg.audits.rand]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "0.8.5 -> 0.9.1" - -[[audits.isrg.audits.rand]] -who = "Tim Geoghegan " -criteria = "safe-to-deploy" -delta = "0.9.1 -> 0.9.2" - -[[audits.isrg.audits.rand]] -who = "David Cook " -criteria = "safe-to-deploy" -delta = "0.9.2 -> 0.10.0" - [[audits.isrg.audits.rayon-core]] who = "Ameer Ghani " criteria = "safe-to-deploy" @@ -1446,6 +1312,49 @@ criteria = "safe-to-deploy" delta = "2.0.0 -> 2.0.1" aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" +[[audits.mozilla.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.57 -> 1.0.61" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Bobby Holley " +criteria = "safe-to-deploy" +delta = "1.0.58 -> 1.0.57" +notes = "No functional differences, just CI config and docs." +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.61 -> 1.0.62" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.62 -> 1.0.68" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Mike Hommey " +criteria = "safe-to-deploy" +delta = "1.0.68 -> 1.0.69" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.71 -> 1.0.95" +aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" + +[[audits.mozilla.audits.anyhow]] +who = "Jan-Erik Rediger " +criteria = "safe-to-deploy" +delta = "1.0.95 -> 1.0.103" +aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" + [[audits.mozilla.audits.block-buffer]] who = "Mike Hommey " criteria = "safe-to-deploy" @@ -1466,38 +1375,6 @@ delta = "0.1.1 -> 0.2.1" notes = "Very minor changes." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.crossbeam-channel]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "0.5.8 -> 0.5.11" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.crossbeam-channel]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "0.5.11 -> 0.5.12" -notes = "Minimal change fixing a memory leak." -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.crossbeam-channel]] -who = "Glenn Watson " -criteria = "safe-to-deploy" -delta = "0.5.12 -> 0.5.13" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.crossbeam-channel]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "0.5.13 -> 0.5.14" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - -[[audits.mozilla.audits.crossbeam-channel]] -who = "Jan-Erik Rediger " -criteria = "safe-to-deploy" -delta = "0.5.14 -> 0.5.15" -notes = "Fixes a regression from an earlier version which could lead to a double free" -aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" - [[audits.mozilla.audits.crunchy]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1523,31 +1400,6 @@ version = "1.0.7" notes = "Simple hasher implementation with no unsafe code." aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" -[[audits.mozilla.audits.getrandom]] -who = "Chris Martin " -criteria = "safe-to-deploy" -delta = "0.2.15 -> 0.3.1" -notes = """ -I've looked over all unsafe code, and it appears to be safe, fully initializing the rng buffers. -In addition, I've checked Linux, Windows, Mac, and Android more thoroughly against API -documentation. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.getrandom]] -who = "Emilio Cobos Álvarez " -criteria = "safe-to-deploy" -delta = "0.3.1 -> 0.3.3" -notes = """ -Biggest non-trivial change is a new UEFI back-end, which looks reasonable to -the best of my ability: There's some trickiness on initialization but doesn't -look unsafe, at worse it leaks, and it might not if the relevant pointers are -static/non-owning. Other changes also look reasonable too: some tweaks to -inlining and a syscall-based linux back-end, whose relevant unsafe code looks -reasonable. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.hashbrown]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1633,42 +1485,12 @@ version = "11.1.5" notes = "Small random number generator, explicitly not cryptographically secure, no use of unsafe code, no dependencies" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.proc-macro-error-attr2]] -who = "Kagami Sascha Rosylight " -criteria = "safe-to-deploy" -version = "2.0.0" -notes = "No unsafe block." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.proc-macro-error2]] -who = "Kagami Sascha Rosylight " -criteria = "safe-to-deploy" -version = "2.0.1" -notes = "No unsafe block with a lovely `#![forbid(unsafe_code)]`." -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.proc-macro2]] who = "Jan-Erik Rediger " criteria = "safe-to-deploy" delta = "1.0.94 -> 1.0.106" aggregated-from = "https://raw.githubusercontent.com/mozilla/glean/main/supply-chain/audits.toml" -[[audits.mozilla.audits.rand]] -who = "Henrik Skupin " -criteria = "safe-to-deploy" -delta = "0.8.5 -> 0.8.6" -notes = """ -Fixes RUSTSEC-2026-0097 by removing `log` dependency. Removes `simd_support` -feature. No new dependencies or unsafe code. -""" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - -[[audits.mozilla.audits.regex-automata]] -who = "Benjamin VanderSloot " -criteria = "safe-to-deploy" -delta = "0.4.9 -> 0.4.14" -aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml" - [[audits.mozilla.audits.serde]] who = "Erich Gubler " criteria = "safe-to-deploy" @@ -1811,12 +1633,6 @@ delta = "0.10.3 -> 0.10.4" notes = "Adds panics to prevent a block size of zero from causing unsoundness." aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.crossbeam-utils]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "0.8.20 -> 0.8.21" -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - [[audits.zcash.audits.crunchy]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -1889,12 +1705,6 @@ criteria = "safe-to-deploy" delta = "0.3.0 -> 0.3.1" aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.r-efi]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "5.2.0 -> 5.3.0" -aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml" - [[audits.zcash.audits.rustc_version]] who = "Jack Grigg " criteria = "safe-to-deploy" @@ -1917,20 +1727,6 @@ delta = "0.4.0 -> 0.4.1" notes = "Changes to `Command` usage are to add support for `RUSTC_WRAPPER`." aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" -[[audits.zcash.audits.rustversion]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.0.20 -> 1.0.21" -notes = "Build script change is to fix building with `-Zfmt-debug=none`." -aggregated-from = "https://raw.githubusercontent.com/zcash/zcash/master/qa/supply-chain/audits.toml" - -[[audits.zcash.audits.rustversion]] -who = "Jack Grigg " -criteria = "safe-to-deploy" -delta = "1.0.21 -> 1.0.22" -notes = "Changes to generated code are to prepend a clippy annotation." -aggregated-from = "https://raw.githubusercontent.com/zcash/wallet/main/supply-chain/audits.toml" - [[audits.zcash.audits.universal-hash]] who = "Daira Hopwood " criteria = "safe-to-deploy"